This update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21 fixes the following issues:
Changes in go compilers:
- Switch from update-alternatives to new method.
- Packaging improvements:
* Revert %ghost /usr/bin/go /usr/bin/gofmt which prevents install
of a working go command. Refs boo#1245878 bsc#1264395
* Based on feedback from Factory maintainers restore the original
lifecycle for these files: Each go1.x toolchain shares
ownership of a go and gofmt symlink managed by the alternatives
system (update-alternatives and libalternatives).
This update for go1.24-openssl fixes the following issues:
- Update to version 1.24.13 (jsc#SLE-18320)
- CVE-2025-58189: crypto/tls: ALPN negotiation error contains attacker controlled information. (bsc#1251255)
- CVE-2025-61725: net/mail: excessive CPU consumption in ParseAddress. (bsc#1251253)
- CVE-2025-58188: crypto/x509: panic when validating certificates with DSA public keys. (bsc#1251260)
- CVE-2025-58185: encoding/asn1: pre-allocating memory when parsing DER payload can cause memory exhaustion. (bsc#1251258)
- CVE-2025-58186: net/http: lack of limit when parsing cookies can cause memory exhaustion. (bsc#1251259)
- CVE-2025-61723: enc